Analysis
- max time kernel
95s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 08:34
Behavioral task
behavioral1
Sample
2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260810-kgmt3afa39
- SHA256 08289969fcda26711d13ccce8b1bfd04de896e29263f5cc2875095e1ec4dd12e
- MD5 514b9f615fdeed36dbc84ea326798fce
- SHA1 d41e81e9c029c80bc8a0e19f30edca7a858d0783
- SHA512 d7d1c01719e5441450c543670c2a21d429231969facf9c0ac46886080daef2fe3a373ca9e444e6c2012cf8fe6bb7b9ae5ca015f1c37e89e32975c802e3a71fd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaoZc43mnXoZ643mnXoZ6i6cMJlP:A3k03kHRJI3k03kHRJd
- TLSH T1A595AE03EB9500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/3364-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244c7-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3392-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3364-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3392-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a3-1257.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000020268-1629.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000202de-1657.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00130000000006ff-2061.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244c7-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x00020000000216a3-1257.dat aspack_v212_v242 behavioral1/files/0x0008000000020268-1629.dat aspack_v212_v242 behavioral1/files/0x00020000000202de-1657.dat aspack_v212_v242 behavioral1/files/0x00130000000006ff-2061.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3392 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3364 2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3392 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_514b9f615fdeed36dbc84ea326798fce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3364
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 08289969fcda26711d13ccce8b1bfd04de896e29263f5cc2875095e1ec4dd12e
- MD5 514b9f615fdeed36dbc84ea326798fce
- SHA1 d41e81e9c029c80bc8a0e19f30edca7a858d0783
- SHA512 d7d1c01719e5441450c543670c2a21d429231969facf9c0ac46886080daef2fe3a373ca9e444e6c2012cf8fe6bb7b9ae5ca015f1c37e89e32975c802e3a71fd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaoZc43mnXoZ643mnXoZ6i6cMJlP:A3k03kHRJI3k03kHRJd
- TLSH T1A595AE03EB9500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
- Size 2.0MB
- SHA256 30a00d225c8ead98e35511adbee5a62770644fdea849d22da31dd1f6d8abaf86
- MD5 b717a27070d38bf4160048c3fe732392
- SHA1 cbbea3b82de6ed1594c60d5b0786dcbcc7dec6d5
- SHA512 af367cc3833a06437977c82bc5948e6d5f6c26ac9e4aeeb6142c51724b53ce680ebb9b314367f3f44bdeda14cf1047495f66108db0359eae99149484461c44c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaoZc43mnXoZ643mnXoZ6i6cMJl2:A3k03kHRJI3k03kHRJHI
- TLSH T11EA5AE03E79500E9E10AC1749AD69A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 2.0MB
- SHA256 00319353f1d848df8259e9776bbecd1589e7588a47fb88e506db5cab361e909a
- MD5 6ccab0a3f7be72197fcd2b80639f63c3
- SHA1 00c35f7ba8e55a84807ed0f23debb0272afd4df6
- SHA512 91dea93ad2c98524840cfb7b01d1c34ed217705e1359f09d872d039bdb0e08d5604bd450dee97b767e882cebf916058953e512fb5a66169f557c9751f81b834e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaoZc43mnXoZ643mnXoZ6i6cMJle:A3k03kHRJI3k03kHRJLw
- TLSH T101A5AE03E79500E9E10AC1749AD69A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 0b5e954f57183838be0ffb6cd8a13975b24e6b07d0b35f519428febd8a93ab49
- MD5 c744a56dfb514e4401ede8dd4bd806c5
- SHA1 14e8e47f002d18d22d52c087d29fd771f6fea243
- SHA512 a3d19fdb9aa7d27d2821b01fb77aed51660de61b4b5c5cfed6b0beeab9e102ed0c11bcba65ac2ab8f3d0d3b023b0b353723782073f106757902ffc8c347f208a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaoZc43mnXoZ643mnXoZ6i6cMJln:A3k03kHRJI3k03kHRJpPji0Aj
- TLSH T1D4C58D17FBA401F5E027C174CAE69A66FA717842173096CF1358C6292F63BD0AB3E365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.0MB
- SHA256 5a0488b42454eb21b492f226d3675c02ad4812a096eb0e77c65aff5f35cae7d5
- MD5 33b91bcb1258f6e9997c644444249e59
- SHA1 192238a84435cf543148df88e962aeff142ebb3c
- SHA512 212098c709fbb8ecaeba3131efc06b363a62912690f55ede9859064ffbedf1df7099dd6b69944b369875d649d46b0928327d5863d27c867d778aae2a7ad2e524
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaoZc43mnXoZ643mnXoZ6i6cMJl1:A3k03kHRJI3k03kHRJb
- TLSH T1CDA59E03E79500E5D14A81709ADA8A22FA75BD52176097DF2368F7152F72BC0BF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe
- Size 2.1MB
- SHA256 49e39f3a83b18a72e803f6ee9a62dab966b3aaf32b7fe7e4e2ebd5cbf5ecb7e2
- MD5 51bd106530b42269104ec993f00c4645
- SHA1 14a39e4d479e22768ba80d06ece909f17136cfd6
- SHA512 242defb85cd385f56db4f9159cfde7068ea7a59bfe98f98af3f472318026831b1d5f75c49e01affecbddb31da3633206eb4780659c03a2c308906634e958ccd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaoZc43mnXoZ643mnXoZ6i6cMJlw:A3k03kHRJI3k03kHRJ5i2WH3
- TLSH T1A1A5AE13EB9400F9D10B81749AE99626FB75BC52176093CF2358C6192F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH